CVE-2026-76519 is a critical, unauthenticated arbitrary file-write vulnerability in the Advanced Malware Protection (AMP) attachment-scanning feature of Cisco Secure Email Gateway, triggered by a crafted email attachment, that can lead to root command execution on the device, and Cisco PSIRT confirmed active exploitation in October 2026.
Vulnerability summary
CVSS base score
9.8
Critical severity
EPSS score (FIRST)
1.6%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2026-76519 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Cisco Secure Email Gateway (AsyncOS) | cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* | AsyncOS 15.5 before 15.5.5-014; 16.0 (all versions); 16.5 before 16.5.0-780, on Secure Email Gateway C1xxV/C3xxV/C6xxV virtual appliances and C195/C395/C695 hardware appliances (fixed in AsyncOS 15.5.5-014 or 16.5.0-780, plus Content Scanner Tools 25.3.0.5525 or later) |
What does this mean for affected devices?
CVE-2026-76519 is a vulnerability (CWE-23, relative path traversal) in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. NVD's description states it is "due to improper handling of email attachments when the file reputation service is enabled" and that "an attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device," with a successful exploit allowing the attacker "to write arbitrary files and execute commands with root privileges on the underlying operating system" (NVD).
NVD lists the vulnerability status as "Analyzed" with a CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD).
CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a required-action due date of 2026-10-17, confirming the vulnerability is being actively exploited (CISA KEV).
Cisco's own advisory (cisco-sa-esa-afw-zqYJkjxp) lists AsyncOS for Secure Email Gateway as affected across 15.5 releases before 15.5.5-014, all 16.0 releases, and 16.5 releases before 16.5.0-780, states "there are no workarounds that address this vulnerability," and confirms "in October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." The fix requires upgrading to AsyncOS 15.5.5-014 or 16.5.0-780 together with Content Scanner Tools 25.3.0.5525 or later (Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp).
As of 2026-10-21, FIRST scores the probability of exploitation at 0.01573 (75.185th percentile) — elevated for a vulnerability only days past disclosure, consistent with the confirmed in-the-wild activity (FIRST EPSS).
Because no workaround exists and exploitation is confirmed, any Cisco Secure Email Gateway appliance with AMP/file-reputation scanning enabled on an affected AsyncOS build should be patched immediately, with logs reviewed for signs of prior exploitation.
Evidence
- Unauthenticated, remote arbitrary file write in the AMP feature of Cisco Secure Email Gateway via a crafted email attachment, enabling root command execution. — NVD
- CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; NVD status is "Analyzed". — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-14, due date 2026-10-17. — CISA KEV
- Affects AsyncOS 15.5 before 15.5.5-014, all 16.0 releases, and 16.5 before 16.5.0-780; no workarounds exist; fixed in AsyncOS 15.5.5-014/16.5.0-780 plus Content Scanner Tools 25.3.0.5525+; Cisco PSIRT confirmed active exploitation in October 2026. — Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp
- EPSS score is 0.01573 (75.185th percentile) as of 2026-10-21. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What triggers the arbitrary file write in this vulnerability?
An attacker sends an email containing a crafted attachment through an affected gateway while the Advanced Malware Protection (AMP) file-reputation service is enabled; improper handling of that attachment lets the attacker write arbitrary files and execute commands with root privileges on the underlying OS (per NVD).
Does updating AsyncOS alone fix this, or is something else required?
Both — the fix requires upgrading to AsyncOS 15.5.5-014 or 16.5.0-780 together with Content Scanner Tools 25.3.0.5525 or later; updating only one component is not described as sufficient (per Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp).
Which AsyncOS releases are affected?
15.5 releases before 15.5.5-014, all 16.0 releases, and 16.5 releases before 16.5.0-780 (per Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp).
Is there a way to mitigate this without patching, for example by disabling AMP?
Cisco's advisory states plainly that "there are no workarounds that address this vulnerability," and confirms active exploitation was observed in October 2026, so patching is the only remediation described (per Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp).
Questions about this page?